Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Database Tables

Here is my Question and i hope i can get an answer.

I want to have the ability for KiwiSyslog to write to different SQL tables for eample i want windows events to write to one SQL table and Cisco Devices write to another. The reason why i ask this questions is becuase of the amount of noise that Cisco ASA devices create and it impacts scheduled reports to run in timley fashion if everything is dumped into one database table.

Any advice or Help would be greatly appreciated....But if this can not be done may be it would be nice to have this as a feature in a future relase of KiwiSyslog.

Thanks
LD

Find more posts tagged with

syslog

sql

Accepted answers

All comments

MarieB

Hi LD--

I've marked this for the PM to review and see about getting you and answer.

Kuz

Hi LD,

You should be able to just filter on the messageText; to identify Windows Events, and have them log to a different table.

Assuming your windows events are coming from either Snare or SolarWinds Log Forwarder for Windows - those events are tagged with "MSWinEventLog"

Rule (1) "Log MSWinEventLog" to DB
+Filter
- Message text: Simple: "MSWinEventLog" (substring search)
+Action
- Log to database: WinEventLog table
- Stop processing message

Rule (2) "Log the rest" to DB
+Action
- Log to database

So long as you place Rule (1) above Rule (2) it will be executed first. The "Stop processing message" action in Rule (1) ensures that the same event isn't logged to DB twice.

You can actually use this approach for many different log sources (by repeating Rule (1)), so long as you have a filter that is specific enough to identify a single source. "MSWinEventLog" should be enough for Log Forwarder or Snare sources, but identifying Cisco ASA may be more difficult.

eg.

Rule (1) "Log MSWinEventLog" to DB
+Filter
- Message text: Simple: "MSWinEventLog" (substring search)
+Action
- Log to database: WinEventLog table
- Stop processing message

Rule (2) "Log XXX" to DB
+Filter
- "XXX" messages
+Action
- Log to database: XXX table
- Stop processing message

Rule (3) "Log AAA" to DB
+Filter
- "AAA" messages
+Action
- Log to database: AAA table
- Stop processing message